pyroc
Comedy Machine
LEVEL 1
300 XP
Researchers have demonstrated a new attack vector that threatens users of several popular browsers and video cards. The method is based on the use of WebGPU.
The new cyber threat is examined in a report by specialists from the Graz University of Technology in Austria and the University of Rennes in France.
It is noted that during the study, experts “felt” the ubiquitous WebGPU API, which allows web developers to use the graphics processor for high-performance computing in the browser.
By using this API, researchers were able to reproduce the attack, working entirely in a browser with JavaScript enabled. The new approach makes it easier to carry out remote cyber attacks.
According to the researchers, they were able to identify one of the first GPU cache side channel attack vectors from the browser itself. To exploit it, it is enough to lure the user to a special site where malicious WebGPU code is located.
There is also a nuance: the potential victim needs to be kept on the resource for several minutes while the exploit works. To do this, you can slip the user an article, reading which the visitor will just hold out for the required time.
The identified vector can be used to extract sensitive information, including passwords, as it allows for keystroke timing. In addition, the method allows the theft of AES encryption keys based on the GPU, which will take several minutes.
All compromised data can be transmitted at speeds up to 10 Kbps.
Researchers alerted representatives from Mozilla, AMD, NVIDIA and Chromium about the problem, after which NVIDIA even issued an official notice.
The new cyber threat is examined in a report by specialists from the Graz University of Technology in Austria and the University of Rennes in France.
It is noted that during the study, experts “felt” the ubiquitous WebGPU API, which allows web developers to use the graphics processor for high-performance computing in the browser.
By using this API, researchers were able to reproduce the attack, working entirely in a browser with JavaScript enabled. The new approach makes it easier to carry out remote cyber attacks.
According to the researchers, they were able to identify one of the first GPU cache side channel attack vectors from the browser itself. To exploit it, it is enough to lure the user to a special site where malicious WebGPU code is located.
There is also a nuance: the potential victim needs to be kept on the resource for several minutes while the exploit works. To do this, you can slip the user an article, reading which the visitor will just hold out for the required time.
The identified vector can be used to extract sensitive information, including passwords, as it allows for keystroke timing. In addition, the method allows the theft of AES encryption keys based on the GPU, which will take several minutes.
All compromised data can be transmitted at speeds up to 10 Kbps.
Researchers alerted representatives from Mozilla, AMD, NVIDIA and Chromium about the problem, after which NVIDIA even issued an official notice.